ch 10: Information Systems Security Flashcards
what is the goal of information systems security
-it is really about trade offs btw security and freedom
(ex loss of freedom of choosing your own password in echnage for increased security as you are forced to create a stronger pw making it diffucult for hackers to crack)
also a trade off of what
cost and risk
what is a threat
a person/org that seeks to obtain or alter data or other info systems assets illegally without having the owners persmission and often without the owners knowledge
a vulnerability is
an opportunity for threats to gain access to individual/org assets
whats a safeguard
some measure that individuals/org take to block the threat from obtaining the asset
what is the target
the asset that is desired by the threat
what are the types of threats
-human error, computer crime, natural disasters
what are the types of losss
-unauthroized data disclosure
-incorrect data modification
-faulty service
-denial of service
-loss of infrastructure
unauthorized data disclosure
-social engineering
-pretexting
-phishing
-spoofing
- ip/email spoofing
-sniffing
-packet sniffer/analyzer
-natural disasters
-hacking
sniffing/packet sniffers
a technique for intercepting computer communications. with wired networks, sniffing requires a physical connection to the network. with wireless networks, no connection is required and wardrivers are used
war drivers
take computers with wireless connections through an area and search for unprotected wireless networks
hacking
activities that seek to compromise digital devices, such as computers, smartphones, tablets, and even entire networks
incorrect data modification
-procedures incorreclt designed or not followed
-ex increasing customers discount or incorrectly modiying employees salary
-placing incorrect data on company web site
incorrect data modification cause
-improper internal controls systems
-system errors
-faulty recovery actions after a diseaster
faulty service
include problems that result bc of incorrect system operation
-incorrect DM
-procedural mistakes
-programming errors
-it installation errors
-usurpation
what is usurpation
when computer criminals invade a comp system and replace legitmate probles with their own, unauthorized ones that shut down legitimate applications and
substitute their own processing to spy, steal and manipulate data, or
achieve other purposes.
denial of service (DoS)
human error or lack of procedures
-humans inadvertently shut down a web server or corporate gateway router by starting a computationaly intensive application
dos attacks
-malicious hacker intentionally floods a web server with millions of bogus service requests
-computer worms create artifical traffic so legitimate traffic cannot get thru
loss of infrastructure
-human accidents
-theof/terrorist events
-disgruntled/terminated employee
-natural disasters
-advanced persistent threat (APT)
protective actions
-use antiservice software
-delete browser cookies
-make appropriate trade off to protect you and ur bsuiness
current highest computer crime
malicious code
how should you respond to security threats (5)
-create strong pw
-use multiple pw
-take security seriously
-send no valuable data via email or im
-use https at trusted, reputable vendors
how should organizations respond to security threats
senior management create company wide policies
-what sensitive data will be stored
-how will data be processed
-how will data be shared with other organizations
-how can employees and others request changes to inaccurate data
teachincal safegaurds on
-hardware and software
-firewalls
-identification and authorization
-malware
data safegaurds on data
-passwords
-encryption
-backup and recovery
human safeguards on procedures and people
-hiring
-training
-education
identification
identifies the user
authentication
-authenticates the user (pw)
-personal identification number, biometric authentixation such as finger prints, and single sign on
encryption
process of transforming clear text into coded, unintelligible text for secure storage or communication
key
string of bits used to encrypt data (unlocks message)
different for symmetric encryption and asymmetric encryption
symmetric encryption
the same key is used encode and to decode
asymmetric encryption
2 keys are used, 1 key encodes the message and the other key decods the message
firewalls
computing device that prevents unauthorized access
-perimeter firewall sits outside the organization network
-internal firewall sits inside the network
-packet filtering firewall examines each part of messahe and determines whetehr to ket that part pass basing it off ip source and other data
spyware and adware symptoms
-slow system start up
-many advertisinments
-suspicious broswer homepage changes
-suspicious changes to the taskbar
malware symptoms
-viruses
-trojan horses
-worms
-spyware
-adware
-ransomeware
malware protections
-antivirus and antispyware systems
-open emails only from known sources
-install software updates
position definitions
-seperate duties and authorites
-determine least privledge
-document position sensitivity
dissemination and enforcement
responisbility
accountability
complience
termination
friendly/unfriendly
How can human safeguards protect against security
threats?
Account Management
– Standards for new user accounts, modification
of account permissions, removal of unneeded
accounts
Password Management
– Users change passwords frequently
Help Desk Policies
– Provide means of authenticating users
